@ecosyste-ms/critical

SQLite database of critical open source packages from ecosyste.ms.

The database is rebuilt daily and published to npm and as a GitHub release. Versions use MAJOR.MINOR.YYYYMMDD where major/minor track schema changes and patch is the build date.

Install

npm install @ecosyste-ms/critical

The package includes a pre-built critical-packages.db file:

import { databasePath } from '@ecosyste-ms/critical'
import Database from 'better-sqlite3'

const db = new Database(databasePath)
const pkg = db.prepare('SELECT * FROM packages WHERE name = ?').get('lodash')

See ecosyste-ms/mcp for a full example.

Download

You can also grab the database directly from the releases page:

• critical-packages.db - uncompressed SQLite
• critical-packages.db.gz - gzip compressed

Building

To build the database yourself:

import { build, createDatabase } from '@ecosyste-ms/critical'

await build({
  dbPath: 'critical-packages.db',
  fetchVersionsData: true,
  onProgress: console.log
})

From the command line:

npx @ecosyste-ms/critical                    # full build with versions
npx @ecosyste-ms/critical --skip-versions    # faster, packages only
npx @ecosyste-ms/critical -o my-db.db        # custom output path
npx @ecosyste-ms/critical --stats            # show database statistics

Schema

packages

Column	Type	Description
id	INTEGER	Primary key from ecosyste.ms
ecosystem	TEXT	Package ecosystem (npm, pypi, rubygems, etc.)
name	TEXT	Package name
purl	TEXT	Package URL (pkg:npm/lodash)
namespace	TEXT	Package namespace if applicable
description	TEXT	Package description
homepage	TEXT	Project homepage URL
repository_url	TEXT	Source repository URL
licenses	TEXT	SPDX license identifier
normalized_licenses	TEXT	JSON array of normalized license identifiers
latest_version	TEXT	Latest release version number
versions_count	INTEGER	Total number of versions
downloads	INTEGER	Download count
downloads_period	TEXT	Period for download count (e.g., last-month)
dependent_packages_count	INTEGER	Number of packages depending on this
dependent_repos_count	INTEGER	Number of repositories depending on this
first_release_at	TEXT	ISO 8601 timestamp of first release
latest_release_at	TEXT	ISO 8601 timestamp of latest release
last_synced_at	TEXT	When ecosyste.ms last synced this package
keywords	TEXT	Space-separated keywords for FTS

Indexes: (ecosystem, name) unique, purl, licenses, ecosystem

versions

Column	Type	Description
package_id	INTEGER	Foreign key to packages
number	TEXT	Version number

Primary key: (package_id, number)

advisories

Column	Type	Description
id	INTEGER	Auto-increment primary key
package_id	INTEGER	Foreign key to packages
uuid	TEXT	Advisory UUID (GHSA-xxxx-xxxx-xxxx)
url	TEXT	Advisory URL
title	TEXT	Advisory title
description	TEXT	Advisory description
severity	TEXT	Severity level (LOW, MODERATE, HIGH, CRITICAL)
published_at	TEXT	ISO 8601 publish timestamp
cvss_score	REAL	CVSS score

Indexes: package_id, uuid, severity, (package_id, uuid) unique

repo_metadata

Column	Type	Description
package_id	INTEGER	Primary key, foreign key to packages
owner	TEXT	Repository owner/organization
repo_name	TEXT	Repository name
full_name	TEXT	Full name (owner/repo)
host	TEXT	Host (github.com, gitlab.com, etc.)
language	TEXT	Primary language
stargazers_count	INTEGER	GitHub stars
forks_count	INTEGER	Fork count
open_issues_count	INTEGER	Open issues
archived	INTEGER	1 if archived, 0 otherwise
fork	INTEGER	1 if a fork, 0 otherwise

Indexes: full_name, owner

packages_fts

FTS5 virtual table for full-text search on ecosystem, name, description, and keywords.

build_info

Column	Type	Description
id	INTEGER	Always 1
built_at	TEXT	ISO 8601 build timestamp
package_count	INTEGER	Total packages
version_count	INTEGER	Total versions
advisory_count	INTEGER	Total advisories

Example Queries

SBOM enrichment by purl:

SELECT * FROM packages WHERE purl = 'pkg:npm/lodash';

-- Check if a specific version exists
SELECT * FROM versions v
JOIN packages p ON v.package_id = p.id
WHERE p.purl = 'pkg:npm/lodash' AND v.number = '4.17.21';

Find packages with known vulnerabilities:

SELECT p.ecosystem, p.name, a.uuid, a.severity, a.title
FROM packages p
JOIN advisories a ON p.id = a.package_id
WHERE a.severity IN ('HIGH', 'CRITICAL');

License audit:

SELECT ecosystem, name, licenses
FROM packages
WHERE licenses NOT IN ('MIT', 'Apache-2.0', 'BSD-3-Clause');

Full-text search:

SELECT p.* FROM packages p
JOIN packages_fts ON p.id = packages_fts.rowid
WHERE packages_fts MATCH 'http client';

Packages by ecosystem:

SELECT * FROM packages WHERE ecosystem = 'npm';

Most depended-on packages:

SELECT ecosystem, name, dependent_packages_count
FROM packages
ORDER BY dependent_packages_count DESC
LIMIT 100;

License

CC-BY-SA-4.0